diff --git a/.gitignore b/.gitignore
index 1293ac74..054609b4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,3 +40,4 @@ dist
 .b2-account-info*
 tests-scratch
 .mypy_cache
+charts/benji/charts/
diff --git a/charts/benji/templates/_helpers.tpl b/charts/benji/templates/_helpers.tpl
index 53a2e1c1..85d220e3 100644
--- a/charts/benji/templates/_helpers.tpl
+++ b/charts/benji/templates/_helpers.tpl
@@ -43,3 +43,22 @@ Create hostname:port pair pointing to the Prometheus pushgateway
 {{- define "benji.pushgateway" -}}
 {{- printf "%s-%s" .Release.Name .Values.pushgateway.nameOverride | trunc 63 | trimSuffix "-" -}}:{{ .Values.pushgateway.service.port }}
 {{- end -}}
+
+{{/*
+ceph conf
+*/}}
+{{- define "benji.ceph-conf" -}}
+[global]
+mon_host = {{ .Values.ceph.mon_hosts }}
+
+[client.{{ .Values.ceph.user | default "admin" }}]
+keyring = /etc/ceph/keyring
+{{ end -}}
+
+{{/*
+ceph client keyring
+*/}}
+{{- define "benji.ceph-keyring" -}}
+[client.{{ .Values.ceph.user | default "admin" }}]
+key = {{ .Values.ceph.key }}
+{{ end -}}
diff --git a/charts/benji/templates/configmap.yaml b/charts/benji/templates/configmap.yaml
new file mode 100644
index 00000000..320a603e
--- /dev/null
+++ b/charts/benji/templates/configmap.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.ceph.enabled }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Values.ceph.configMapName }}
+  labels:
+    app.kubernetes.io/name: {{ include "benji.name" . }}
+    helm.sh/chart: {{ include "benji.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: benji
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+data:
+  ceph.conf: |
+{{ include "benji.ceph-conf" . | indent 4 }}
+{{- end }}
diff --git a/charts/benji/templates/cron-jobs.yaml b/charts/benji/templates/cron-jobs.yaml
index e876a514..6810461c 100644
--- a/charts/benji/templates/cron-jobs.yaml
+++ b/charts/benji/templates/cron-jobs.yaml
@@ -42,6 +42,10 @@ spec:
           serviceAccountName: {{ tuple $ "" | include "benji.fullname" }}
           dnsPolicy: ClusterFirstWithHostNet
           restartPolicy: Never
+{{- if $.Values.benji.initContainers }}
+          initContainers:
+{{ toYaml $.Values.benji.initContainers | indent 12 }}
+{{- end }}
           containers:
             - name: benji
               image: "{{ $.Values.benji.image.registry }}/{{ $.Values.benji.image.repository }}:{{ $.Values.benji.image.tag }}"
@@ -62,6 +66,10 @@ spec:
 {{- if $.Values.pushgateway.enabled }}
                 - name: PROM_PUSH_GATEWAY
                   value: "{{ include "benji.pushgateway" $ }}"
+{{- end }}
+{{- with $.Values.ceph.user }}
+                - name: CEPH_ARGS
+                  value: "--name client.{{ . }}"
 {{- end }}
                 - name: TZ
                   value: "{{ $.Values.timeZone }}"
@@ -79,9 +87,15 @@ spec:
 {{- end }}
           hostNetwork: false
           volumes:
+    {{- if $.Values.benji.externalSecretConfig }}
+            - name: benji-config
+              secret:
+                secretName: {{ $.Values.benji.externalSecretConfig }}
+    {{- else }}
             - name: benji-config
               secret:
                 secretName: {{ tuple $ "" | include "benji.fullname" }}
+    {{- end }}
             - name: tz-config
               hostPath:
                 path: /usr/share/zoneinfo/{{ $.Values.timeZone }}
diff --git a/charts/benji/templates/maint-deployment.yaml b/charts/benji/templates/maint-deployment.yaml
index f93e435d..62e92056 100644
--- a/charts/benji/templates/maint-deployment.yaml
+++ b/charts/benji/templates/maint-deployment.yaml
@@ -27,10 +27,18 @@ spec:
     spec:
       serviceAccountName: {{ tuple . "" | include "benji.fullname" }}
       dnsPolicy: ClusterFirstWithHostNet
+{{- if .Values.benji.initContainers }}
+      initContainers:
+{{ toYaml .Values.benji.initContainers | indent 8 }}
+{{- end }}
       containers:
         - name: benji
           image: "{{ .Values.benji.image.registry }}/{{ .Values.benji.image.repository }}:{{ .Values.benji.image.tag }}"
           imagePullPolicy: {{ .Values.benji.image.pullPolicy }}
+{{- with .Values.benji.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+{{- end }}
           securityContext:
             privileged: true
           env:
@@ -45,6 +53,10 @@ spec:
 {{- if .Values.pushgateway.enabled }}
             - name: PROM_PUSH_GATEWAY
               value: "{{ include "benji.pushgateway" $ }}"
+{{- end }}
+{{- with .Values.ceph.user }}
+            - name: CEPH_ARGS
+              value: "--name client.{{ . }}"
 {{- end }}
             - name: TZ
               value: "{{ .Values.timeZone }}"
@@ -62,9 +74,15 @@ spec:
 {{- end }}
       hostNetwork: false
       volumes:
+{{- if  $.Values.benji.externalSecretConfig }}
+        - name: benji-config
+          secret:
+            secretName: {{ $.Values.benji.externalSecretConfig }}
+{{- else }}
         - name: benji-config
           secret:
             secretName: {{ tuple . "" | include "benji.fullname" }}
+{{- end }}
         - name: tz-config
           hostPath:
             path: /usr/share/zoneinfo/{{ .Values.timeZone }}
diff --git a/charts/benji/templates/secret.yaml b/charts/benji/templates/secret.yaml
index 54405a58..aa31a752 100644
--- a/charts/benji/templates/secret.yaml
+++ b/charts/benji/templates/secret.yaml
@@ -1,3 +1,4 @@
+{{ if not .Values.benji.externalSecretConfig }}
 ---
 apiVersion: v1
 kind: Secret
@@ -10,3 +11,22 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
 data:
   benji.yaml: {{ printf "%s\n" (.Values.benji.configuration | toYaml) | b64enc }}
+{{ end }}
+
+{{- if .Values.ceph.createKeyringSecret }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: benji-ceph-keyring
+  labels:
+    app.kubernetes.io/name: {{ include "benji.name" . }}
+    helm.sh/chart: {{ include "benji.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: benji
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+type: Opaque
+data:
+  keyring: |
+{{ include "benji.ceph-keyring" . | b64enc | indent 4 }}
+{{- end }}
diff --git a/charts/benji/values.yaml b/charts/benji/values.yaml
index 6b9f6921..eae1b83b 100644
--- a/charts/benji/values.yaml
+++ b/charts/benji/values.yaml
@@ -17,6 +17,13 @@ benji:
 
   affinity: {}
 
+  initContainers: []
+
+  command: []
+
+## insert a secret name here that contains your configuration, otherwise the below configuration is used
+  externalSecretConfig: ""
+
   configuration:
     configurationVersion: '1'
     databaseEngine: sqlite:////tmp/benji.sqlite
@@ -177,3 +184,5 @@ pushgateway:
   nameOverride: pushgateway
   service:
     port: 9091
+
+ceph: {}